Messages in log with SNAT target

I've been using this kind of configuration on my Linux router for a few years:

eth0 80.223.77.223, public internet ip
eth0:0 10.0.0.1, private network ip

IP forwarding enabled.

And a rule for iptables:
-A POSTROUTING -s 10.0.0.0/255.255.255.0 -d ! 10.0.0.0/255.255.255.0 -j SNAT --to-source 80.223.77.223

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.0.0        0.0.0.0         255.255.255.0   U     10     0        0 eth0
80.223.64.0     0.0.0.0         255.255.240.0   U     10     0        0 eth0
0.0.0.0         80.223.64.1     0.0.0.0         UG    10     0        0 eth0

However, I get lots of this kind of messages in the dmesg while routing:
host 10.0.0.4/if2 ignores redirects for 70.35.xxx.xxx to 80.223.64.1.

I've been using this kind of configuration on my Linux router for a few years:

eth0 80.223.77.223, public internet ip
eth0:0 10.0.0.1, private network ip

IP forwarding enabled.

And a rule for iptables:
-A POSTROUTING -s 10.0.0.0/255.255.255.0 -d ! 10.0.0.0/255.255.255.0 -j SNAT --to-source 80.223.77.223

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.0.0        0.0.0.0         255.255.255.0   U     10     0        0 eth0
80.223.64.0     0.0.0.0         255.255.240.0   U     10     0        0 eth0
0.0.0.0         80.223.64.1     0.0.0.0         UG    10     0        0 eth0

However, I get lots of this kind of messages in the dmesg while routing:
host 10.0.0.4/if2 ignores redirects for 70.35.xxx.xxx to 80.223.64.1.

It's NOT default behaviour of NT to drop ICMP Redirects.

It IS default behaviour not to accept gateways, that are not on the local subnet.

It's NOT default behaviour of NT to drop ICMP Redirects.

It IS default behaviour not to accept gateways, that are not on the local subnet.

Hello,

Quoted 4 lines · Anssi Hannula

I've been using this kind of configuration on my Linux router for a few years:

Quoted 2 lines

eth0 80.223.77.223, public internet ip
eth0:0 10.0.0.1, private network ip

You know that having both internet and a private LAN on the same interface is a *very* bad idea, don't you ? I suppose you have no other choice.

Quoted 16 lines

IP forwarding enabled.

And a rule for iptables:
-A POSTROUTING -s 10.0.0.0/255.255.255.0 -d ! 10.0.0.0/255.255.255.0 -j SNAT --to-source 80.223.77.223

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref
Use Iface
10.0.0.0 0.0.0.0 255.255.255.0 U 10 0
0 eth0
80.223.64.0 0.0.0.0 255.255.240.0 U 10 0
0 eth0
0.0.0.0 80.223.64.1 0.0.0.0 UG 10 0
0 eth0

Quoted 2 lines

However, I get lots of this kind of messages in the dmesg while routing:
host 10.0.0.4/if2 ignores redirects for 70.35.xxx.xxx to 80.223.64.1.

[and so on]

Here's what happens. On your router box, all routes use the same interface eth0, so when it receives a packet for another destination than the box itself, it sends an "ICMP Redirect" message to the source IP address meaning "hey, there is a more direct route to destination 70.35.x.x using gateway 80.223.64.1 instead of me. Please update your routing table".

Happily, the 1.0.0.4 host ignores the "ICMP Redirect" messages. One reason is I think that's a default behaviour of Windows NT. Another reason is that host has probably no direct route to the proposed gateway address. Anyway, if it didn't ignore the "ICMP Redirect", it would probably lose connectivity with internet hosts because of its private address.

Note : destination NAT (DNAT) on the same network blocks the sending of "ICMP Redirect" messages by the routing decision, because destination NAT takes place before the routing decision. But source NAT (SNAT, MASQUERADE) doesn't, because it takes place after the routing decision, so it's too late (see Netfilter diagram in
http://www.netfilter.org/documentation/HOWTO//NAT-HOWTO.txt).

You can enable or disable the sending of "ICMP Redirect" messages with the kernel parameter send_redirect.

send_redirects - BOOLEAN
Send redirects, if router.
send_redirects for the interface will be enabled if at least one of conf/{all,interface}/send_redirects is set to TRUE,
it will be disabled otherwise
Default: TRUE

To disable sending "ICMP redirect" on eth0 :

echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects

or :

sysctl -w net/ipv4/conf/all/send_redirects=0
sysctl -w net/ipv4/conf/eth0/send_redirects=0

Hello,

Quoted 4 lines · Anssi Hannula

I've been using this kind of configuration on my Linux router for a few years:

Quoted 2 lines

eth0 80.223.77.223, public internet ip
eth0:0 10.0.0.1, private network ip

You know that having both internet and a private LAN on the same interface is a *very* bad idea, don't you ? I suppose you have no other choice.

Quoted 16 lines

IP forwarding enabled.

And a rule for iptables:
-A POSTROUTING -s 10.0.0.0/255.255.255.0 -d ! 10.0.0.0/255.255.255.0 -j SNAT --to-source 80.223.77.223

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref
Use Iface
10.0.0.0 0.0.0.0 255.255.255.0 U 10 0
0 eth0
80.223.64.0 0.0.0.0 255.255.240.0 U 10 0
0 eth0
0.0.0.0 80.223.64.1 0.0.0.0 UG 10 0
0 eth0

Quoted 2 lines

However, I get lots of this kind of messages in the dmesg while routing:
host 10.0.0.4/if2 ignores redirects for 70.35.xxx.xxx to 80.223.64.1.

[and so on]

Here's what happens. On your router box, all routes use the same interface eth0, so when it receives a packet for another destination than the box itself, it sends an "ICMP Redirect" message to the source IP address meaning "hey, there is a more direct route to destination 70.35.x.x using gateway 80.223.64.1 instead of me. Please update your routing table".

Happily, the 1.0.0.4 host ignores the "ICMP Redirect" messages. One reason is I think that's a default behaviour of Windows NT. Another reason is that host has probably no direct route to the proposed gateway address. Anyway, if it didn't ignore the "ICMP Redirect", it would probably lose connectivity with internet hosts because of its private address.

Note : destination NAT (DNAT) on the same network blocks the sending of "ICMP Redirect" messages by the routing decision, because destination NAT takes place before the routing decision. But source NAT (SNAT, MASQUERADE) doesn't, because it takes place after the routing decision, so it's too late (see Netfilter diagram in
http://www.netfilter.org/documentation/HOWTO//NAT-HOWTO.txt).

You can enable or disable the sending of "ICMP Redirect" messages with the kernel parameter send_redirect.

send_redirects - BOOLEAN
Send redirects, if router.
send_redirects for the interface will be enabled if at least one of conf/{all,interface}/send_redirects is set to TRUE,
it will be disabled otherwise
Default: TRUE

To disable sending "ICMP redirect" on eth0 :

echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects

or :

sysctl -w net/ipv4/conf/all/send_redirects=0
sysctl -w net/ipv4/conf/eth0/send_redirects=0

The security risk is, and it is a MAJOR one, especially with WiFi networks is that any PC on the network could just be set up with a private IP on your private network, start sniffing for passwords etc.

It's a very, very bad idea to put your public and private WiFi infratructure on the same physical network. I would say, there's even no point in firewalling this. Firewalling is seperating, you are combining.

-Sietse

________________________________

From: [email protected] on behalf of Anssi Hannula
Sent: Mon 24-Jul-06 13:03
To: [email protected]
Subject: Re: Messages in log with SNAT target

Quoted 1 line · Pascal Hambourg

Hello,

Hi, and thank you very much for your thorough answer.

Quoted 6 lines

Quoted 3 lines · Anssi Hannula

I've been using this kind of configuration on my Linux router for a few years:

Quoted 7 lines

Quoted 2 lines

eth0 80.223.77.223, public internet ip
eth0:0 10.0.0.1, private network ip

You know that having both internet and a private LAN on the same interface is a *very* bad idea, don't you ? I suppose you have no other choice.

Oops, I didn't know :((

Is the bad part on it having both of them on the same physical network, or only the fact that they are on the same interface?

Then again, this is a wireless network where some hosts have public+private IPs and some hosts private IPs, so I guess it would be pretty non-practical to have two interfaces on every system which I want to have public IP too.

What is the security risk here, exactly?

Quoted 54 lines

Quoted 16 lines

IP forwarding enabled.

And a rule for iptables:
-A POSTROUTING -s 10.0.0.0/255.255.255.0 -d ! 10.0.0.0/255.255.255.0 -j SNAT --to-source 80.223.77.223

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref
Use Iface
10.0.0.0 0.0.0.0 255.255.255.0 U 10 0
0 eth0
80.223.64.0 0.0.0.0 255.255.240.0 U 10 0
0 eth0
0.0.0.0 80.223.64.1 0.0.0.0 UG 10 0
0 eth0

Quoted 2 lines

However, I get lots of this kind of messages in the dmesg while routing:
host 10.0.0.4/if2 ignores redirects for 70.35.xxx.xxx to 80.223.64.1.

[and so on]

Here's what happens. On your router box, all routes use the same interface eth0, so when it receives a packet for another destination than the box itself, it sends an "ICMP Redirect" message to the source IP address meaning "hey, there is a more direct route to destination 70.35.x.x using gateway 80.223.64.1 instead of me. Please update your routing table".

Happily, the 1.0.0.4 host ignores the "ICMP Redirect" messages. One reason is I think that's a default behaviour of Windows NT. Another reason is that host has probably no direct route to the proposed gateway address. Anyway, if it didn't ignore the "ICMP Redirect", it would probably lose connectivity with internet hosts because of its private address.

Note : destination NAT (DNAT) on the same network blocks the sending of "ICMP Redirect" messages by the routing decision, because destination NAT takes place before the routing decision. But source NAT (SNAT, MASQUERADE) doesn't, because it takes place after the routing decision, so it's too late (see Netfilter diagram in
http://www.netfilter.org/documentation/HOWTO//NAT-HOWTO.txt).

You can enable or disable the sending of "ICMP Redirect" messages with the kernel parameter send_redirect.

send_redirects - BOOLEAN
Send redirects, if router.
send_redirects for the interface will be enabled if at least one of conf/{all,interface}/send_redirects is set to TRUE,
it will be disabled otherwise
Default: TRUE

To disable sending "ICMP redirect" on eth0 :

Quoted 7 lines

echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects

or :

sysctl -w net/ipv4/conf/all/send_redirects=0
sysctl -w net/ipv4/conf/eth0/send_redirects=0

--
Anssi Hannula

The security risk is, and it is a MAJOR one, especially with WiFi networks is that any PC on the network could just be set up with a private IP on your private network, start sniffing for passwords etc.

It's a very, very bad idea to put your public and private WiFi infratructure on the same physical network. I would say, there's even no point in firewalling this. Firewalling is seperating, you are combining.

-Sietse

________________________________

From: [email protected] on behalf of Anssi Hannula
Sent: Mon 24-Jul-06 13:03
To: [email protected]
Subject: Re: Messages in log with SNAT target

Quoted 1 line · Pascal Hambourg

Hello,

Hi, and thank you very much for your thorough answer.

Quoted 6 lines

Quoted 3 lines · Anssi Hannula

I've been using this kind of configuration on my Linux router for a few years:

Quoted 7 lines

Quoted 2 lines

eth0 80.223.77.223, public internet ip
eth0:0 10.0.0.1, private network ip

You know that having both internet and a private LAN on the same interface is a *very* bad idea, don't you ? I suppose you have no other choice.

Oops, I didn't know :((

Is the bad part on it having both of them on the same physical network, or only the fact that they are on the same interface?

Then again, this is a wireless network where some hosts have public+private IPs and some hosts private IPs, so I guess it would be pretty non-practical to have two interfaces on every system which I want to have public IP too.

What is the security risk here, exactly?

Quoted 59 lines

Quoted 16 lines

IP forwarding enabled.

And a rule for iptables:
-A POSTROUTING -s 10.0.0.0/255.255.255.0 -d ! 10.0.0.0/255.255.255.0 -j SNAT --to-source 80.223.77.223

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref
Use Iface
10.0.0.0 0.0.0.0 255.255.255.0 U 10 0
0 eth0
80.223.64.0 0.0.0.0 255.255.240.0 U 10 0
0 eth0
0.0.0.0 80.223.64.1 0.0.0.0 UG 10 0
0 eth0

Quoted 2 lines

However, I get lots of this kind of messages in the dmesg while routing:
host 10.0.0.4/if2 ignores redirects for 70.35.xxx.xxx to 80.223.64.1.

[and so on]

Here's what happens. On your router box, all routes use the same interface eth0, so when it receives a packet for another destination than the box itself, it sends an "ICMP Redirect" message to the source IP address meaning "hey, there is a more direct route to destination 70.35.x.x using gateway 80.223.64.1 instead of me. Please update your routing table".

Happily, the 1.0.0.4 host ignores the "ICMP Redirect" messages. One reason is I think that's a default behaviour of Windows NT. Another reason is that host has probably no direct route to the proposed gateway address. Anyway, if it didn't ignore the "ICMP Redirect", it would probably lose connectivity with internet hosts because of its private address.

Note : destination NAT (DNAT) on the same network blocks the sending of "ICMP Redirect" messages by the routing decision, because destination NAT takes place before the routing decision. But source NAT (SNAT, MASQUERADE) doesn't, because it takes place after the routing decision, so it's too late (see Netfilter diagram in
http://www.netfilter.org/documentation/HOWTO//NAT-HOWTO.txt).

You can enable or disable the sending of "ICMP Redirect" messages with the kernel parameter send_redirect.

send_redirects - BOOLEAN
Send redirects, if router.
send_redirects for the interface will be enabled if at least one of conf/{all,interface}/send_redirects is set to TRUE,
it will be disabled otherwise
Default: TRUE

To disable sending "ICMP redirect" on eth0 :

echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects

or :

Quoted 2 lines

sysctl -w net/ipv4/conf/all/send_redirects=0
sysctl -w net/ipv4/conf/eth0/send_redirects=0

--
Anssi Hannula

If it's your home network and you've encrypted your WiFi connection, it would be minor personal risks.

I would never do this in a major company however.

But if it's anyhow possible for you, I would still advise you to split it up, it'll make things more comprehensible and easier to manage.

-Sietse

________________________________

From: Anssi Hannula [mailto:[email protected]]
Sent: Mon 24-Jul-06 14:01
To: Sietse van Zanen
Cc: [email protected]
Subject: Re: Messages in log with SNAT target

Quoted 6 lines · Sietse van Zanen

The security risk is, and it is a MAJOR one, especially with WiFi networks is that any PC on the network could just be set up with a private IP on your private network, start sniffing for passwords etc.

It's a very, very bad idea to put your public and private WiFi infratructure on the same physical network. I would say, there's even no point in firewalling this. Firewalling is seperating, you are combining.

-Sietse

In this case the private network is only a very small home network. I don't see there being too big a risk of anyone setting up a box with private IP on the network with harm on their mind. If that would be possible, wouldn't the security of the whole system be compromised so much that the private/public separation doesn't matter anymore?

The main purpose of the private IPs here is the ease of use and having no public IP for a system if so wanted.

Quoted 106 lines

________________________________

From: [email protected] on behalf of Anssi Hannula
Sent: Mon 24-Jul-06 13:03
To: [email protected]
Subject: Re: Messages in log with SNAT target

Quoted 1 line · Pascal Hambourg

Hello,

Hi, and thank you very much for your thorough answer.

Quoted 7 lines

Quoted 3 lines · Anssi Hannula

I've been using this kind of configuration on my Linux router for a few years:

Quoted 7 lines

Quoted 2 lines

eth0 80.223.77.223, public internet ip
eth0:0 10.0.0.1, private network ip

You know that having both internet and a private LAN on the same interface is a *very* bad idea, don't you ? I suppose you have no other choice.

Oops, I didn't know :((

Is the bad part on it having both of them on the same physical network, or only the fact that they are on the same interface?

Then again, this is a wireless network where some hosts have public+private IPs and some hosts private IPs, so I guess it would be pretty non-practical to have two interfaces on every system which I want to have public IP too.

What is the security risk here, exactly?

Quoted 57 lines

Quoted 16 lines

IP forwarding enabled.

And a rule for iptables:
-A POSTROUTING -s 10.0.0.0/255.255.255.0 -d ! 10.0.0.0/255.255.255.0 -j SNAT --to-source 80.223.77.223

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref
Use Iface
10.0.0.0 0.0.0.0 255.255.255.0 U 10 0
0 eth0
80.223.64.0 0.0.0.0 255.255.240.0 U 10 0
0 eth0
0.0.0.0 80.223.64.1 0.0.0.0 UG 10 0
0 eth0

Quoted 2 lines

However, I get lots of this kind of messages in the dmesg while routing:
host 10.0.0.4/if2 ignores redirects for 70.35.xxx.xxx to 80.223.64.1.

[and so on]

Here's what happens. On your router box, all routes use the same interface eth0, so when it receives a packet for another destination than the box itself, it sends an "ICMP Redirect" message to the source IP address meaning "hey, there is a more direct route to destination 70.35.x.x using gateway 80.223.64.1 instead of me. Please update your routing table".

Happily, the 1.0.0.4 host ignores the "ICMP Redirect" messages. One reason is I think that's a default behaviour of Windows NT. Another reason is that host has probably no direct route to the proposed gateway address. Anyway, if it didn't ignore the "ICMP Redirect", it would probably lose connectivity with internet hosts because of its private address.

Note : destination NAT (DNAT) on the same network blocks the sending of "ICMP Redirect" messages by the routing decision, because destination NAT takes place before the routing decision. But source NAT (SNAT, MASQUERADE) doesn't, because it takes place after the routing decision, so it's too late (see Netfilter diagram in
http://www.netfilter.org/documentation/HOWTO//NAT-HOWTO.txt).

You can enable or disable the sending of "ICMP Redirect" messages with the kernel parameter send_redirect.

send_redirects - BOOLEAN
Send redirects, if router.
send_redirects for the interface will be enabled if at least one of conf/{all,interface}/send_redirects is set to TRUE,
it will be disabled otherwise
Default: TRUE

To disable sending "ICMP redirect" on eth0 :

echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects

Quoted 9 lines

Quoted 4 lines

or :

sysctl -w net/ipv4/conf/all/send_redirects=0
sysctl -w net/ipv4/conf/eth0/send_redirects=0

--
Anssi Hannula

--
Anssi Hannula

Quoted 6 lines · Sietse van Zanen

The security risk is, and it is a MAJOR one, especially with WiFi networks is that any PC on the network could just be set up with a private IP on your private network, start sniffing for passwords etc.

It's a very, very bad idea to put your public and private WiFi infratructure on the same physical network. I would say, there's even no point in firewalling this. Firewalling is seperating, you are combining.

-Sietse

In this case the private network is only a very small home network. I don't see there being too big a risk of anyone setting up a box with private IP on the network with harm on their mind. If that would be possible, wouldn't the security of the whole system be compromised so much that the private/public separation doesn't matter anymore?

The main purpose of the private IPs here is the ease of use and having no public IP for a system if so wanted.

Quoted 20 lines · Anssi Hannula

Quoted 20 lines

Quoted 10 lines · Sietse van Zanen

The security risk is, and it is a MAJOR one, especially with WiFi networks is that any PC on the network could just be set up with a private IP on your private network, start sniffing for passwords etc.

It's a very, very bad idea to put your public and private WiFi infratructure on the same physical network.
I would say, there's even no point in firewalling this. Firewalling is seperating, you are combining.

-Sietse

In this case the private network is only a very small home network. I don't see there being too big a risk of anyone setting up a box with private IP on the network with harm on their mind. If that would be possible, wouldn't the security of the whole system be compromised so much that the private/public separation doesn't matter anymore?

Quoted 2 lines

Quoted 2 lines

The main purpose of the private IPs here is the ease of use and having no public IP for a system if so wanted.

Hopefully, for yer sake, you are the only home for mile and miles around....Yet, I doubt such is the case, so you are a risk to all sadly.

Quoted 20 lines · Anssi Hannula

Quoted 20 lines

Quoted 10 lines · Sietse van Zanen

The security risk is, and it is a MAJOR one, especially with WiFi networks is that any PC on the network could just be set up with a private IP on your private network, start sniffing for passwords etc.

It's a very, very bad idea to put your public and private WiFi infratructure on the same physical network.
I would say, there's even no point in firewalling this. Firewalling is seperating, you are combining.

-Sietse

In this case the private network is only a very small home network. I don't see there being too big a risk of anyone setting up a box with private IP on the network with harm on their mind. If that would be possible, wouldn't the security of the whole system be compromised so much that the private/public separation doesn't matter anymore?

Quoted 2 lines

Quoted 2 lines

The main purpose of the private IPs here is the ease of use and having no public IP for a system if so wanted.

Hopefully, for yer sake, you are the only home for mile and miles around....Yet, I doubt such is the case, so you are a risk to all sadly.

That, or put your WiFi in a DMZ behind a firewall, and have the firewall protect your private network.

Making WiFi DMZ's is sort of standard practice.

-sietse

________________________________

From: Anssi Hannula [mailto:[email protected]]
Sent: Wed 26-Jul-06 10:16
To: R. DuFresne
Cc: Sietse van Zanen; [email protected]
Subject: Re: Messages in log with SNAT target

Quoted 24 lines · R. DuFresne

Quoted 21 lines · Anssi Hannula

Quoted 21 lines

Quoted 10 lines · Sietse van Zanen

The security risk is, and it is a MAJOR one, especially with WiFi networks is that any PC on the network could just be set up with a private IP on your private network, start sniffing for passwords etc.

It's a very, very bad idea to put your public and private WiFi infratructure on the same physical network.
I would say, there's even no point in firewalling this. Firewalling is seperating, you are combining.

-Sietse

In this case the private network is only a very small home network. I don't see there being too big a risk of anyone setting up a box with private IP on the network with harm on their mind. If that would be possible, wouldn't the security of the whole system be compromised so much that the private/public separation doesn't matter anymore?

Quoted 8 lines

Quoted 2 lines

Quoted 2 lines

The main purpose of the private IPs here is the ease of use and having no public IP for a system if so wanted.

Hopefully, for yer sake, you are the only home for mile and miles around....Yet, I doubt such is the case, so you are a risk to all sadly.

So, what do you suggest, then?

That I have 2 separate wireless networks, one for the internet and one for the private network?

(the WLAN is of course WPA encrypted)

--
Anssi Hannula

That, or put your WiFi in a DMZ behind a firewall, and have the firewall protect your private network.

Making WiFi DMZ's is sort of standard practice.

-sietse

________________________________

From: Anssi Hannula [mailto:[email protected]]
Sent: Wed 26-Jul-06 10:16
To: R. DuFresne
Cc: Sietse van Zanen; [email protected]
Subject: Re: Messages in log with SNAT target

Quoted 24 lines · R. DuFresne

Quoted 21 lines · Anssi Hannula

Quoted 21 lines

Quoted 10 lines · Sietse van Zanen

The security risk is, and it is a MAJOR one, especially with WiFi networks is that any PC on the network could just be set up with a private IP on your private network, start sniffing for passwords etc.

It's a very, very bad idea to put your public and private WiFi infratructure on the same physical network.
I would say, there's even no point in firewalling this. Firewalling is seperating, you are combining.

-Sietse

In this case the private network is only a very small home network. I don't see there being too big a risk of anyone setting up a box with private IP on the network with harm on their mind. If that would be possible, wouldn't the security of the whole system be compromised so much that the private/public separation doesn't matter anymore?

Quoted 8 lines

Quoted 2 lines

Quoted 2 lines

The main purpose of the private IPs here is the ease of use and having no public IP for a system if so wanted.

Hopefully, for yer sake, you are the only home for mile and miles around....Yet, I doubt such is the case, so you are a risk to all sadly.

So, what do you suggest, then?

That I have 2 separate wireless networks, one for the internet and one for the private network?

(the WLAN is of course WPA encrypted)

--
Anssi Hannula

The important issue you have is not WHAT somebody can hack. It's what somebody can DO and ACCESS, WHEN you've been hacked.

If somebody does manage to take over one of your systems, he most certainly gains access to ALL to systems on the same physical (sub)network. As ALL your systems are on the same net, draw the conclusion.

Combine that conclusion with the innate vulnerability of WiFi networks and do the math. It's unwise to use your set up. period. It's not for nothing that reccomendations always talk about shielding your WiFi with a firewall. Now for personal use, it might be acceptable to do otherwise, but that's up to you, as always the choice is between security and convenience.

________________________________

From: Anssi Hannula [mailto:[email protected]]
Sent: Wed 26-Jul-06 13:21
To: Sietse van Zanen
Cc: R. DuFresne; [email protected]
Subject: Re: Messages in log with SNAT target

Quoted 5 lines · Sietse van Zanen

That, or put your WiFi in a DMZ behind a firewall, and have the firewall protect your private network.

Making WiFi DMZ's is sort of standard practice.

-sietse

I don't really get it.

As far as I can see, there are currently two weak points in my network:
1. Someone could compromise one of the hosts remotely.
2. Someone could crack the WLAN encryption.

No matter what kind of firewalls or network schemes I deploy, neither of those points goes away.

Quoted 51 lines

________________________________

From: Anssi Hannula [mailto:[email protected]]
Sent: Wed 26-Jul-06 10:16
To: R. DuFresne
Cc: Sietse van Zanen; [email protected]
Subject: Re: Messages in log with SNAT target

Quoted 26 lines · R. DuFresne

Quoted 22 lines · Anssi Hannula

Quoted 22 lines

Quoted 10 lines · Sietse van Zanen

The security risk is, and it is a MAJOR one, especially with WiFi networks is that any PC on the network could just be set up with a private IP on your private network, start sniffing for passwords etc.

It's a very, very bad idea to put your public and private WiFi infratructure on the same physical network.
I would say, there's even no point in firewalling this. Firewalling is seperating, you are combining.

-Sietse

In this case the private network is only a very small home network. I don't see there being too big a risk of anyone setting up a box with private IP on the network with harm on their mind. If that would be possible, wouldn't the security of the whole system be compromised so much that the private/public separation doesn't matter anymore?

Quoted 8 lines

Quoted 2 lines

Quoted 2 lines

The main purpose of the private IPs here is the ease of use and having no public IP for a system if so wanted.

Hopefully, for yer sake, you are the only home for mile and miles around....Yet, I doubt such is the case, so you are a risk to all sadly.

So, what do you suggest, then?

Quoted 8 lines

That I have 2 separate wireless networks, one for the internet and one for the private network?

(the WLAN is of course WPA encrypted)

--
Anssi Hannula

--
Anssi Hannula

Quoted 5 lines · Sietse van Zanen

The important issue you have is not WHAT somebody can hack. It's what somebody can DO and ACCESS, WHEN you've been hacked.

If somebody does manage to take over one of your systems, he most certainly gains access to ALL to systems on the same physical (sub)network. As ALL your systems are on the same net, draw the conclusion.

Combine that conclusion with the innate vulnerability of WiFi networks and do the math. It's unwise to use your set up. period. It's not for nothing that reccomendations always talk about shielding your WiFi with a firewall. Now for personal use, it might be acceptable to do otherwise, but that's up to you, as always the choice is between security and convenience.

Thanks for your reply. Unfortunately, you do not seem to offer any alternative to my current setup.

Quoted 18 lines · Anssi Hannula

Quoted 18 lines

Quoted 14 lines · Sietse van Zanen

The important issue you have is not WHAT somebody can hack. It's what somebody can DO and ACCESS, WHEN you've been hacked.

If somebody does manage to take over one of your systems, he most certainly gains access to ALL to systems on the same physical (sub)network. As ALL your systems are on the same net, draw the conclusion.

Combine that conclusion with the innate vulnerability of WiFi networks and do the math. It's unwise to use your set up. period. It's not for nothing that reccomendations always talk about shielding your WiFi with a firewall. Now for personal use, it might be acceptable to do otherwise, but that's up to you, as always the choice is between security and convenience.

Quoted 2 lines

Quoted 2 lines

Thanks for your reply. Unfortunately, you do not seem to offer any alternative to my current setup.

Actually he did offer an alternative, though you had to read carefully his answer; go with a wired set of networks, both distinct from one another.

Firewall those networks, adding further isolation from eachother and from the publc internet at large.